fix(portainer): request identity encoding on the ingress listener (#2943)

* fix(portainer): request identity encoding on the ingress listener

Portainer compresses its own responses, so every response reached Home
Assistant's ingress relay gzipped and chunked, with no Content-Length.
Both relay hops (Supervisor api/ingress.py and Core hassio/ingress.py)
only take their buffered path for responses carrying a Content-Length
under 4 MB; everything else goes through the streaming path, where an
aiohttp error surfaces to the browser as 502 Bad Gateway even though the
add-on's own nginx logged a 200.

proxy_params.conf already stripped Accept-Encoding, but the location
block declares its own proxy_set_header directives, and nginx discards
every server-level proxy_set_header once a location sets any of its own
(the comment above those lines warns about exactly this). The strip was
therefore dead config.

The same server block serves both the ingress listener and the direct
web UI port, so the strip is scoped through a map on $server_port:
ingress gets identity, direct access keeps compression. The map keys on
the direct-access port rather than the templated ingress port, so the
default stays correct if the ingress port ever changes.

Verified with a local nginx against the live Portainer backend:
- ingress listener, client sending "Accept-Encoding: gzip, deflate"
  -> identity, Content-Length: 14203
- direct listener, same request -> Content-Encoding: gzip, chunked
- direct listener, no Accept-Encoding -> identity, Content-Length
- websocket upgrade through ingress still reaches Portainer (401 auth)
- nginx -t passes for both the ssl and non-ssl rendered variants

Partial mitigation only: vendor.js (5.7 MB) and main.js (7.0 MB) exceed
the 4 MB buffering threshold uncompressed and still stream. This
supersedes 2.43.0.1, which disabled nginx's own gzip module rather than
the compressor that was actually running.

Refs #2766

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(portainer): request identity explicitly on the ingress listener

Address review feedback: use "identity" rather than an empty value as
the map default. Both were verified to produce identity responses with a
Content-Length from Portainer, and both leave direct access on 9099
compressed, but "identity" states the intent explicitly instead of
relying on the server's choice when no Accept-Encoding is present.

Also reword the changelog entry for readability.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

portainer/CHANGELOG.md

@@ -1,4 +1,7 @@
  
+## 2.44.0.1 (2026-08-05)
+- Ingress: request uncompressed responses from Portainer so they carry a Content-Length and stay on the Home Assistant relay's buffered path. Portainer compresses its own responses, and the Accept-Encoding strip in proxy_params.conf never applied because the location block declares its own proxy_set_header directives, which makes nginx discard the server-level ones. Partial mitigation for #2766: the page itself and all assets under 4 MB are now buffered, but the two large JavaScript bundles still exceed the relay's 4 MB buffering threshold. Direct access on the web UI port keeps compression
+ 
 ## 2.44.0 (2026-08-01)
 - Update to latest version from portainer/portainer (changelog : https://github.com/portainer/portainer/releases)
  

portainer/config.yaml

@@ -42,4 +42,4 @@ schema:
 slug: portainer
 udev: true
 url: https://github.com/alexbelgium/hassio-addons
-version: "2.44.0"
+version: "2.44.0.1"

portainer/rootfs/etc/nginx/nginx.conf

@@ -49,6 +49,17 @@ http {
         ''      close;
     }
 
+    # Ingress needs Portainer to answer uncompressed, so the responses carry a
+    # Content-Length and stay on the relay's buffered path. Direct access on
+    # 9099 does not go through the relay, so it keeps compression.
+    # Keyed on the direct-access port rather than the ingress port: the ingress
+    # port is templated from the add-on config, so defaulting to identity keeps
+    # ingress correct even if that port ever changes.
+    map $server_port $upstream_accept_encoding {
+        default identity;
+        9099    $http_accept_encoding;
+    }
+
     include /etc/nginx/includes/resolver.conf;
     include /etc/nginx/includes/upstream.conf;
 

portainer/rootfs/etc/nginx/templates/ingress.gtpl

@@ -20,5 +20,13 @@ server {
     proxy_set_header Upgrade $http_upgrade;
     proxy_set_header Host $http_host;
     proxy_set_header X-Forwarded-Host $http_host;
+
+    # Portainer gzips its own responses, which makes them chunked with no
+    # Content-Length. Home Assistant's ingress relay only buffers responses
+    # under 4 MB that carry a Content-Length, so everything else falls into
+    # its streaming path. Asking upstream for identity keeps the small
+    # responses buffered. The map in nginx.conf applies this to the ingress
+    # listener only, so direct access on 9099 keeps compression.
+    proxy_set_header Accept-Encoding $upstream_accept_encoding;
   }
 }